STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025: STIGQter: STIG Summary: Application Programming Interface (API) Security Requirements Guide Version: 1 Release: 1 Benchmark Date: 11 Sep 2025:SV-274839r1143880_rule
V-274839
SRG-APP-000965
SRG-APP-000965-API-001655
CAT II
10
Build or configure the API to properly protect cryptographic keys that protect access tokens.
To check if cryptographic keys that protect access tokens are properly protected in an API:
1. Verify a proper key management system (KMS) is in place to generate, store, and rotate cryptographic keys.
2. Verify that keys are generated and stored using best practices, ensuring they are never exposed in plaintext.
3. Verify keys are stored securely.
4. Verify keys are not hardcoded in application code or exposed in configuration files.
5. Review who and what services have access to the cryptographic keys. Verify only authorized users or services (e.g., API services) have access to them.
6. Verify key rotation procedures are in place, and cryptographic keys are rotated regularly to mitigate the risk of key compromise.
7. Confirm that any access to or usage of cryptographic keys is logged and auditable. This should include who accessed the key, when, and for what purpose.
8. Review the API's documentation to ensure that cryptographic keys are managed and protected according to security guidelines (e.g., NIST, FIPS).
If cryptographic keys are not properly protected, this is a finding.
V-274839
False
SRG-APP-000965-API-001655
To check if cryptographic keys that protect access tokens are properly protected in an API:
1. Verify a proper key management system (KMS) is in place to generate, store, and rotate cryptographic keys.
2. Verify that keys are generated and stored using best practices, ensuring they are never exposed in plaintext.
3. Verify keys are stored securely.
4. Verify keys are not hardcoded in application code or exposed in configuration files.
5. Review who and what services have access to the cryptographic keys. Verify only authorized users or services (e.g., API services) have access to them.
6. Verify key rotation procedures are in place, and cryptographic keys are rotated regularly to mitigate the risk of key compromise.
7. Confirm that any access to or usage of cryptographic keys is logged and auditable. This should include who accessed the key, when, and for what purpose.
8. Review the API's documentation to ensure that cryptographic keys are managed and protected according to security guidelines (e.g., NIST, FIPS).
If cryptographic keys are not properly protected, this is a finding.
M
5703